Abstract: A network device employs a transmitter configured to transmit a registration request to a software defined network (SDN) controller. The network device employs a receiver to receive a reply from the SDN controller. The reply indicates a plurality of provider edge (PE) devices coupled to a carrier network. The network device employs a processor to cause the transmitter and receiver to establish a plurality of asymmetric connections to a virtual private network (VPN) operating over a wide area network (WAN) via the PE devices.

Abstract: A method implemented by a network edge node including adding a first header including a flags field and a data field including a first metadata to a first packet. The network edge node sets a first flag in the flags field of the first header to a first value to indicate that the first packet is a forward flow packet. The network edge node transmits the first packet towards a second network edge node. The network edge node receives a second packet including the first metadata in the data field and a second flag in the flags field set to the first value to indicate that the second packet is a reverse flow packet. The network edge generates a second metadata corresponding to receipt of the second packet and transmits an export message that includes the first metadata and second metadata toward a controller.

Abstract: A method and apparatus for optimizing network delivery of fifth generation (5G) edge application services by weighting network latency along with a load, capacity, and preference of an application server to determine where to transmit a new flow of packets. By using the weighted approach, network traffic can be equalized among multiple instances (e.g., applications) with the same address.

Abstract: A method used by an egress router is disclosed. The egress router receives a first packet from an initial ingress router addressed to an anycast address of an application server. The egress router transmits the first packet to the application server. The egress router receives a second packet from the application server. The second packet is addressed to the initial ingress router. The egress router inserts a sticky destination sub type length value (Sticky-Dst-SubTLV) into a destination option header of the second packet. The egress router transmits the second packet with the Sticky-Dst-SubTLV to the ingress router.

Abstract: A method used by an egress router is disclosed. The egress router obtains a capacity index of an application server attached to the egress router. The egress router further obtains a load index describing a load measurement between the egress router and the application server during a certain time period. The egress router encodes the capacity index and the load index into a packet. The egress router transmits the packet to one or more routers in an Internet protocol (IP) network.

Abstract: A Software Defined Wide Area Network (SD-WAN) edge node is disclosed. The SD-WAN edge node includes edge node SD-WAN ports coupled to untrusted underlay networks. The SD-WAN edge node transmits a first Border Gateway Protocol (BGP) update message advertising WAN (Wide Area Network) properties of the edge node SD-WAN ports to a local controller via an encrypted channel over the untrusted underlay network. The SD-WAN edge node receives a second BGP update message from the local controller, the second BGP update message advertising WAN properties of peer node SD-WAN ports of a peer node. The SD-WAN edge node establishes a security association with the peer node over the untrusted underlay networks based on the WAN properties of the edge node SD-WAN ports and the WAN properties of the peer node SD-WAN ports.

Abstract: Techniques are presented to stitch existing virtual private networks (VPNs), such as MPLS based VPNs, with virtual private clouds (VPCs) in public cloud data centers. The stitching architecture can be realized by configuring a virtual routing application (VRA) in the VPCs and configuring virtual routing applications and a virtual routing application controller in the existing VPN. For VPCs in public clouds that do not have a VRA, traffic can be default routed to VPCs with a VRA.

Abstract: A method implemented by a first edge node in an SD-WAN, the method comprises: establishing a secure management tunnel between an RR in the SD-WAN and the first edge node; advertising properties of the first edge node to the RR via the secure management tunnel for the RR to propagate the properties to a second edge node; establishing a first secure data channel with the second edge node; and exchanging first information with the second edge node. A method implemented by an RR in an SD-WAN, the method comprises: receiving first RTC NLRI from a first edge node in the SD-WAN; receiving second RTC NLRI from a second edge node in the SD-WAN; installing an outbound route filter based on the first RTC NLRI; and processing the second RTC NLRI based on the outbound route filter.

Abstract: A routing device including a memory and a processor. The memory stores instructions. The processor is configured to execute the instructions to receive a signed route origin authorization (ROA), which includes a blockchain hash, and a border gateway protocol (BGP) update message, which includes one or more routes. The processor is further configured to implement a Route Origin Validation (ROV) process using the blockchain hash in the signed ROA to determine whether the one or more routes in the BGP update message are valid; update a routing table to include the one or more routes from the BGP update message when the one or more routes are determined to be valid by the ROV process; and refrain from updating the routing table with the one or more routes from the BGP update message when the one or more routes are determined to be invalid by the ROV process.

Abstract: Techniques are presented to stitch existing virtual private networks (VPNs), such as MPLS based VPNs, with virtual private clouds (VPCs) in public cloud data centers. The stitching architecture can be realized by configuring a virtual routing application (VRA) in the VPCs and configuring virtual routing applications and a virtual routing application controller in the existing VPN. For VPCs in public clouds that do not have a VRA, traffic can be default routed to VPCs with a VRA.

Abstract: A method, an apparatus, and a system are provided for load balancing of a service chain. The method includes: receiving, by a flow classifier, a service chain selection and control policy sent by a policy and charging rules function (PCRF) unit; hashing, by the flow classifier according to a hash quantity, a service flow corresponding to a service chain identifier, to obtain multiple subflows, and adding the service chain identifier and hashing factors to packets of the subflows, where different subflows correspond to different hashing factors; and sending, by the flow classifier, the packets of the subflows after the service chain identifier and the hashing factors are added, to a forwarding device.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.

Abstract: A method for performing virtual private cloud (VPC) routing across multiple public cloud environments. In an embodiment, the method creates a first virtual routing agent (VRA) for a first VPC of a first public cloud. The method sends a registration request to a VRA controller, wherein the registration request comprises a data structure that includes communication parameters of the first VRA. The method receives the communication parameters of other VRAs for other VPCs located in other public cloud environments from the VRA controller. The method uses the communication parameters of the other VRAs for overlay routing of data packets from the first VPC of the first public cloud to other VPCs of other public clouds via the other VRAs of the other VPCs.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.

Abstract: Disclosed are a flow classifier, policy and charging rules function unit and controller. The flow classifier receives a service chain selection control policy sent by a policy and charging rules function unit. The service chain selection control policy includes a corresponding relation between an application type and an identifier of a service chain. The service chain is a path formed by a forwarding device and a value-added service device both of which a service flow with the application type needs to pass through. The flow classifier detects the service flow with the application type based on the service chain selection control policy and adds the identifier of the service chain to a message of the service flow. The flow classifier sends the message of the service flow with the added identifier of the service chain to a forwarding device directly connected to the flow classifier.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.

Abstract: A method performed by a controller configured to implement Border Gateway Protocol (BGP) in a communications system, comprising establishing a controller BGP (cBGP) peer session with a network element (NE), receiving a message for communication through the cBGP session from the NE, determining whether the message is permitted to be communicated through the cBGP session based on whether the message carries routing information; transmitting the message to the NE through the cBGP session when the message is permitted to be communicated through the cBGP session, and receiving a response message of the first type from the NE through the cBGP session.

Abstract: A Software Defined Wide Area Network (SD-WAN) edge node is disclosed. The SD-WAN edge node includes edge node SD-WAN ports coupled to untrusted underlay networks. The SD-WAN edge node transmits a first Border Gateway Protocol (BGP) update message advertising WAN (Wide Area Network) properties of the edge node SD-WAN ports to a local controller via an encrypted channel over the untrusted underlay network. The SD-WAN edge node receives a second BGP update message from the local controller, the second BGP update message advertising WAN properties of peer node SD-WAN ports of a peer node. The SD-WAN edge node establishes a security association with the peer node over the untrusted underlay networks based on the WAN properties of the edge node SD-WAN ports and the WAN properties of the peer node SD-WAN ports.

Abstract: A network device employs a transmitter configured to transmit a registration request to a software defined network (SDN) controller. The network device employs a receiver to receive a reply from the SDN controller. The reply indicates a plurality of provider edge (PE) devices coupled to a carrier network. The network device employs a processor to cause the transmitter and receiver to establish a plurality of asymmetric connections to a virtual private network (VPN) operating over a wide area network (WAN) via the PE devices.

Abstract: A method implemented by a controller in a software defined network (SDN), the method comprising sending, to an overlay edge node, a query message comprising a client specific multicast address, receiving, from the overlay edge node, one or more report messages corresponding to the query message, wherein each of the one or more report messages comprises an address of each of one or more virtual machines (VMs) coupled to the overlay edge node, and updating membership of a multicast group, which is identified by the client specific multicast address, such that the one or more VMs are members in the updated membership of the multicast group.